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A rending application determines that digital content is in 
an encrypted rights-protected form and invoices a Digital Rights 
Management (DRM) sys tem which includes a license store having 
at least one digital Ucensestored therein. Each license corresponds 
to a piece of digital content and includes a decryption key (KD) 
for decrypting the corresponding digital content The DRM system 
locates each license in the license store corresponding to the digital 
content to be rendered, selects one of the located licenses, obtains 
(KD) from the selected license, decrypts the digital content with 
(KD), and returns the decrypted digital content to the rendering 
application for actual rendering. 
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Title of the Invention 

RENDERING DIGITAL CONTENT IN AN ENCRYPTED 
RIGHTS-PROTECTED FORM 
CROSS REFERENCE TO RELATED APPLICATION 
5 This application is a continuation of U.S. Patent Application No. 

09/290,363, filed April 12, 1999 and entitled "ENFORCEMENT ARCHITECTURE 
AND METHOD FOR DIGITAL RIGHTS MANAGEMENT", and claims the benefit 
of U.S. Provisional Application No. 60/126,614, filed March 27, 1999 and entitled 
"ENFORCEMENT ARCHITECTURE AND METHOD FOR DIGITAL RIGHTS 
10 MANAGEMENT", both of which are hereby incorporated by reference.-- 

TECHNICAL FIELD 
The present invention relates to an architecture for enforcing rights in 
digital content. More specifically, the present invention relates to such an enforcement 
architecture that allows access to encrypted digital content only in accordance with 
1 5 parameters specified by license rights acquired by a user of the digital content. 

BACKGROUND OF THE INVENTION 

Digital rights management and enforcement is highly desirable in 
connection with digital content such as digital audio, digital video, digital text, digital 

20 data, digital multimedia, etc., where such digital content is to be distributed to users. 
Typical modes of distribution include tangible devices such as a magnetic (floppy) 
disk, a magnetic tape, an optical (compact) disk (CD), etc., and intangible media such 
as an electronic bulletin board, an electronic network, the Internet, etc. Upon being 
received by the user, such user renders or 'plays' the digital content with the aid of an 

25 appropriate rendering device such as a media player on a personal computer or the like. 

- Typically, a content owner or rights-owner, such as an author, a 
publisher, a broadcaster, etc. (hereinafter "content owner"), wishes to distribute such 
digital content to a user or recipient in exchange for a license fee or some other 
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consideration. Such content owner, given the choice, would likely wish to restrict what 
the user can do with such distributed digital content. For example, the content owner 
would like to restrict the user from copying and re-distributing such content to a second 
user, at least in a manner that denies the content owner a license fee from such second 
user. 

In addition, the content owner may wish to provide the user with the 
flexibility to purchase different types of use licenses at different license fees, while at 
the same time holding the user to the terms of whatever type of license is in fact 
purchased. For example, the content owner may wish to allow distributed digital 
content to be played only a limited number of times, only for a certain total time, only 
on a certain type of machine, only on a certain type of media player, only by a certain 
type of user, etc. 

However, after distribution has occurred, such content owner has very 
little if any control over the digital content. This is especially problematic in view of 
the fact that practically every new or recent personal computer includes the software 
and hardware necessary to make an exact digital copy of such digital content, and to 
download such exact digital copy to a write-able magnetic or optical disk, or to send 
such exact digital copy over a network such as the Internet to any destination. 

Of course, as part of the legitimate transaction where the license fee 
was obtained, the content owner may require the user of the digital content to promise 
not to re-distribute such digital content. However, such a promise is easily made and 
easily broken. A content owner may attempt to prevent such re-distribution through 
any of several known security devices, usually involving encryption and decryption. 
However, there is likely very little that prevents a mildly determined user from 
decrypting encrypted digital content, saving such digital content in an un-encrypted 
form, and then re-distributing same. 

A need exists, then, for providing an enforcement architecture and 
method that allows the controlled rendering or playing of arbitrary forms of digital 
content, where such control is flexible and definable by the content owner of such 
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digital content. A need also exists for providing a controlled rendering environment 
on a computing device such as a personal computer, where the rendering environment 
includes at least a portion of such enforcement architecture. Such controlled rendering 
environment allows that the digital content will only be rendered as specified by the 
5 content owner, even though the digital content is to be rendered on a computing device 
which is not under the control of the content owner. 

Further, a need exists for a trusted component running on the 
computing device, where the trusted component enforces the rights of the content 
owner on such computing device in connection with a piece of digital content, even 

10 against attempts by the user of such computing device to access such digital content 
in ways not permitted by the content owner. As but one example, such a trusted 
software component prevents a user of the computing device from making a copy of 
such digital content, except as otherwise allowed for by the content owner thereof. 
SUMMARY OF THE INVENTION 

15 The aforementioned needs are satisfied at least in part by an 

enforcement architecture and method for digital rights management, where the 
architecture and method enforce rights in protected (secure) digital content available 
on a medium such as the Internet, an optical disk, etc. For purposes of making content 
available, the architecture includes a content server from which the digital content is 

20 accessible over the Internet or the like in an encrypted form. The content server may 
also supply the encrypted digital content for recording on an optical disk or the like, 
wherein the encrypted digital content may be distributed on the optical disk itself. At 
the content server, the digital content is encrypted using an encryption key. and public 
/ private key techniques are employed to bind the digital content with a digital license 

25 at the user's computing device or client machine. 

When a user attempts to render the digital content on a computing 
device, the rendering application invokes a Digital Rights Management (DRM) system 
on such user's computing device. If the user is attempting to render the digital content 
for the first time, the DRM system either directs the user to a license server to obtain 
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a license to render such digital content in the manner sought, or transparently obtains 
such license from such license server without any action necessary on the part of the 
user. The license includes: 

- a decryption key (KD) that decrypts the encrypted digital content; 

- a description of the rights (play, copy, etc.) conferred by the license 
and related conditions (begin date, expiration date, number of plays, 
etc.), where such description is in a digitally readable form; and 

- a digital signature that ensures the integrity of the license. 

The user cannot decrypt and render the encrypted digital content without obtaining 
such a license from the license server. The obtained license is stored in a license store 
in the user's computing device. 

Importantly, the license server only issues a license to a DRM system 
that is 'trusted' (i.e., that can authenticate itself). To implement 'trust', the DRM 
system is equipped with a 'black box' that performs decryption and encryption 
functions for such DRM system. The black box includes a public / private key pair, 
a version number and a unique signature, all as provided by an approved certifying 
authority. The public key is made available to the license server for purposes of 
encrypting portions of the issued license, thereby binding such license to such black 
box. The private key is available to the black box only, and not to the user or anyone 
else, for purposes of decrypting information encrypted with the corresponding public 
key. The DRM system is initially provided with a black box with a public / private key 
pair, and the user is prompted to download from a black box server an updated secure 
black box when the user first requests a license. The black box server provides the 
updated black box, along with a unique public/private key pair. Such updated black 
box is written in unique executable code that will run only on the user's computing 
device, and is re-updated on a regular basis. 

When a user requests a license, the client machine sends the black box 
public key. version number, and signature to the license server, and such license server 
issues a license only if the version number is current and the signature is valid. A 
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license request also includes an identification of the digital content for which a license 
is requested and a key ID that identifies the decryption key associated with the 
requested digital content. The license server uses the black box public key to encrypt 
the decryption key, and the decryption key to encrypt the license terms, then 
downloads the encrypted decryption key and encrypted license terms to the users 
computing device along with a license signature. 

Once the downloaded license has been stored in the DRM system 
license store, the user can render the digital content according to the rights conferred 
M he license and specified in the license terms. When a request is made to render the 
digital content, the black box is caused to decrypt the decryption key and license terms, 
and a DRM system license evaluator evaluates such license terms. The black box 
decrypts the encrypted digital content only if the license evaluation results in a decision 
that the requestor is allowed to play such content. The decrypted content is provided 
to the rendering application for rendering. 

BRIEF DESCRIPTION OF THE DRAWINGS 
The foregoing summary, as well as the following detailed description 
of the embodiments of the present invention, will be better understood when read in 
conjunction with the appended drawings. For the purpose of illustrating the invention, 
there are shown in the drawings embodiments which are presently preferred. As 
should be understood, however, the invention is not limited to the precise arrangements 
and instrumentalities shown. In the drawings: 

Fig. 1 is a block diagram showing an enforcement architecture in 
accordance with one embodiment of the present invention: 

Fig. 2 is a block diagram of the authoring tool of the architecture of 
Fig. 1 in accordance with one embodiment of the present invention; 

Fig. 3 is a block diagram of a digital content package having digital 
content for use in connection with the architecture of Fig. 1 in accordance with one 
embodiment of the present invention; 
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Fig. 4 is a block diagram of the user's computing device of Fig. 1 in 
accordance with one embodiment of the present invention; 

Figs. 5A and 5B are flow diagrams showing the steps performed in 
connection with the Digital Rights Management f DRM) system of the computing 
device of Fig. 4 to render content in accordance with one embodiment of the present 
invention; 

Fig. 6 is a flow diagram showing the steps performed in connection 
with the DRM system of Fig. 4 to determine whether any valid, enabling licenses are 
present in accordance with one embodiment of the present invention; 

Fig. 7 is a flow diagram showing the steps performed in connection 
with the DRM system of Fig. 4 to obtain a license in accordance with one embodiment 
of the present invention; 

Fig. 8 is a block diagram of a digital license for use in connection with 
the architecture of Fig. 1 in accordance with one embodiment of the present invention; 

Fig. 9 is a flow diagram showing the steps performed in connection 
with the DRM system of Fig. 4 to obtain a new black box in accordance with one 
embodiment of the present invention; 

Fig. 1 0 is a flow diagram showing the key transaction steps performed 
in connection with the DRM system of Fig. 4 to validate a license and a piece of digital 
content and render the content in accordance with one embodiment of the present 
invention; 

Fig. 1 1 is a block diagram showing the license evaluator of Fig. 4 along 
with a Digital Rights License (DRL) of a license and a language engine for interpreting 
the DRL in accordance with one embodiment of the present invention; and 

Fig. 12 is a block diagram representing a general purpose computer 
system in which aspects of the present invention and/or portions thereof may be 
incorporated. 
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DETAILEP DESCRIPTION OF THE INVENTION 

Referring to the drawings in details, wherein like numerals are used to 
indicate like elements throughout, there is shown in Fig. 1 an enforcement architecture 
10 in accordance with one embodiment of the present invention. Overall, the 
enforcement architecture 10 allows an owner of digital content 12 to specify license 
rules that must be satisfied before such digital content 12 is allowed to be rendered on 
a user's computing device 14. Such license rules are embodied within a digital license 
16 that the user / user's computing device 14 (hereinafter, such terms are 
interchangeable unless circumstances require otherwise) must obtain from the content 
owner or an agent thereof. The digital content 12 is distributed in an encrypted form, 
and may be distributed freely and widely. Preferably, the decrypting key (KD) for 
decrypting the digital content 12 is included with the license 16. 
COMPUTER ENVIRONMENT 

Fig. 12 and the following discussion are intended to provide a brief 
general description of a suitable computing environment in which the present invention 
and/or portions thereof may be implemented. Although not required, the invention is 
described in the general context of computer-executable instructions, such as program 
modules, being executed by a computer, such as a client workstation or a server. 
Generally, program modules include routines, programs, objects, components, data 
structures and the like that perform particular tasks or implement particular abstract 
data types. Moreover, it should be appreciated that the invention and/or portions 
thereof may be practiced with other computer system configurations, including 
hand-held devices, multi-processor systems, microprocessor-based or programmable 
consumer electronics, network PCs, minicomputers, mainframe computers and the like. 
The invention may also be practiced in distributed computing environments where 
tasks are performed by remote processing devices that are linked through a 
communications network. In a distributed computing environment, program modules 
may be located in both local and remote memory storage devices. 

As shown in Fig. 12, an exemplary general purpose computing system 
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includes a conventional personal computer 1 20 or the like, including a processing unit 
121, a system memory 122, and a system bus 123 that couples various system 
components including the system memory to the processing unit 121 . The system bus 
123 may be any of several types of bus structures including a memory bus or memory 
5 controller, a peripheral bus, and a local bus using any of a variety of bus architectures. 
The system memory includes read-only memory (ROM) 124 and random access 
memory (RAM) 125. A basic input/output system 126 (BIOS), containing the basic 
routines that help to transfer information between elements within the personal 
computer 120, such as during start-up, is stored in ROM 124, 

* 0 The personal computer 1 20 may further include a hard disk drive 1 27 

for reading from and writing to a hard disk (not shown), a magnetic disk drive 128 for 
reading from or writing to a removable magnetic disk 129. and an optical disk drive 
130 for reading from or writing to a removable optical disk 131 such as a CD-ROM 
or other optical media. The hard disk drive 127, magnetic disk drive 128, and optical 

1 5 disk drive 130 are connected to the system bus 123 by a hard disk drive interface 132, 
a magnetic disk drive interface 133. and an optical drive interface 134, respectively. 
The drives and their associated computer-readable media provide non-volatile storage 
of computer readable instructions, data structures, program modules and other data for 
the personal computer 20. 

20 Although the exemplary environment described herein employs a hard 

disk, a removable magnetic disk 129, and a removable optical disk 13 L it should be 
appreciated that other types of computer readable media which can store data that is 
accessible by a computer may also be used in the exemplary operating environment. 
Such other types of media include a magnetic cassette, a flash memory card, a digital 

25 video disk, a Bernoulli cartridge, a random access memory (RAM), a read-only 
memory (ROM), and the like. 

A number of program modules may be stored on the hard disk, 
magnetic disk 129, optical disk 131. ROM 124 or RAM 125, including an operating 
system 135. one or more application programs 136, other program modules 137 and 
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program data 138. A user may enter commands and information into the personal 
computer 120 through input devices such as a keyboard 140 and pointing device 142. 
Other input devices (not shown) may include a microphone, joystick, game pad, 
satellite disk, scanner, or the like. These and other input devices are often connected 
5 to the processing unit 121 through a serial port interface 146 that is coupled to the 
system bus, but may be connected by other interfaces, such as a parallel port, game 
port, or universal serial bus (USB). A monitor 147 or other type of display device is 
also connected to the system bus 123 via an interface, such as a video adapter 148. In 
addition to the monitor 147, a personal computer typically includes other peripheral 

10 output devices (not shown), such as speakers and printers. The exemplary system of 
Fig. 12 also includes a host adapter 1 55, a Small Computer System Interface (SCSI) 
bus 156, and an external storage device 162 connected to the SCSI bus 156. 

The personal computer 120 may operate in a networked environment 
using logical connections to one or more remote computers, such as a remote computer 

15 149. The remote computer 149 may be another personal computer, a server, a router, 
a network PC, a peer device or other common network node, and typically includes 
many or all of the elements described above relative to the personal computer 120, 
although only a memory storage device 150 has been illustrated in Fig. 12. The logical 
connections depicted in Fig. 12 include a local area network-(LAN) 151 and a wide 

20 area network (WAN) 152. Such networking environments are commonplace in offices, 
enterprise-wide computer networks, intranets, and the Internet. 

When used in a LAN networking environment, the personal computer 
120 is connected to the LAN 151 through a network interface or adapter 1 53. When 
used in a WAN networking environment, the personal computer 1 20 typically includes 

25 a modem 154 or other means for establishing communications over the wide area 
network 152, such as the Internet. The modem 1 54. which may be internal or external, 
is connected to the system bus 123 via the serial port interface 146. In a networked 
environment, program modules depicted relative to the personal computer 120, or 
portions thereof, may be stored in the remote memory storage device. It will be 
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appreciated that the network connections shown are exemplary and other means of 
establishing a communications link between the computers may be used. 
ARCHITECTURE 

Referring again to Fig. 1, in one embodiment of the present invention, 
5 the architecture 10 includes an authoring tool 1 8. a content-key database 20, a content 
server 22, a license server 24, and a black box server 26. as well as the aforementioned 
user's computing device 14. 
ARCHITECTURE - Authoring Tool 18 

The authoring tool 1 8 is employed by a content owner to package a 

10. piece of digital content 12 into a form that is amenable for use in connection with the 
architecture 10 of the present invention. In particular, the content owner provides the 
authoring tool 18 with the digital content 12, instructions and/or rules that are to 
accompany the digital content 12, and instructions and/or rules as to how the digital 
content 12 is to be packaged. The authoring tool 18 then produces a digital content 

15 package 12p having the digital content 12 encrypted according to an encryption / 
decryption key, and the instructions and/or rules that accompany the digital content 12. 

In one embodiment of the present invention, the authoring tool 1 8 is 
instructed to serially produce several different digital content 12 packages 12p, each 
having the same digital content 12 encrypted according to a different encryption / 

20 decryption key. As should be understood, having several different packages 12p with 
the same digital content 12 may be useful for tracking the distribution of such packages 
12p / content 12 (hereinafter simply "digital content 12". unless circumstances require 
otherwise). Such distribution tracking is not ordinarily necessary, hut may be used by 
an investigative authority in cases where the digital content 12 has been illegally sold 

25 or broadcast. 

In one embodiment of the present invention, the encryption / decryption 
key that encrypts the digital content 12 is a symmetric key. in that the encryption key 
is also the decryption key (KD). As will be discussed below in more detail, such 
decryption key (KD) is delivered to a user's computing device 14 in a hidden form as 
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part of a license 1 6 for such digital content 12. Preferably, each piece of digital content 
12 is provided with a content ID (or each package 12p is provided with a package ID), 
each decryption key (KD) has a key ID. and the authoring tool 18 causes the 
decryption key (KD), key ID, and content ID (or package ID) for each piece of digital 
content 12 (or each package 12p) to be stored in the content-key database 20. In 
addition, license data regarding t he types of licenses 16 to be issued for the digit al 
content 12 and the terms a nd conditions for each type of license IjunaaLb e stored in 
t he content-key databa se 20, or else in another database (not shown) . Preferably, the 
license data can be modified by the content owner at a later time as circumstances and 
market conditions may require. 

In use, the authoring tool 1 8 is supplied with information including, 
among other things: 

- the digital content 12 to be packaged; 

- the type and parameters of watermarking and/or fingerprinting to be 
employed, if any; 

- the type and parameters of data compression to be employed, if any; 

- the type and parameters of encryption to be employed; 

- the type and parameters of serialization to be employed, if any; and 

- the instructions and/or rules that are to accompany the digital content 
12. 

As is known, a watermark is a hidden, computer-readable signal that is 
added to the digital content 12 as an identifier. A fingerprint is a watermark that is 
different for each instance. As should be understood, an instance is a version of the 
digital content 12 that is unique. Multiple copies of any instance may be made, and 
any copy is of a particular instance. When a specific instance of digital content 12 is 
illegally sold or broadcast, an investigative authority can perhaps identify suspects 
according to the watermark / fingerprint added to such digital content 1 2. 

Data compression may be performed according to any appropriate 
compression algorithm without departing from the spirit and scope of the present 
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invention. For example, the .mp3 or .wav compression algorithm may be employed. 
Of course, the digital content 12 may already be in a compressed state, in which case 
no additional compression is necessary. 

The instructions and/or rules that are to accompany the digital content 
12 may include practically any appropriate instructions, rules, or other information 
without departing from the spirit and scope of the present invention. As will be 
discussed below, such accompanying instructions / rules / information are primarily 
employed by the user and the user's computing device 14 to obtain a license 16 to 
render the digital content 12. Accordingly, such accompanying instructions / rules / 
information may include an appropriately formatted license acquisition script or the 
like, as will be described in more detail below. In addition, or in the alternative, such 
accompanying instructions / rules / information may include 'preview' information 
designed to provide a user with a preview of the digital content 12. 

With the supplied information, the authoring tool 1 8 then produces one 
or more packages 12p corresponding to the digital content 12. Each package 12p may 
then be stored on the content server 22 for distribution to the world. 

In one embodiment of the present invention, and referring now to Fig. 
2, the authoring tool 18 is adynamic authoring tool 18 that receives input parameters 
which can be specified and operated on. Accordingly, such authoring tool 18 can 
rapidly produce multiple variations of package 12p for multiple pieces of digital 
content 12. Preferably, the input parameters are embodied in the form of a dictionary 
28, as shown, where the dictionary 28 includes such parameters as: 

- the name of the input file 29a having the digital content 1 2; 

- the type of encoding that is to take place 

- the encryption / decryption key (KD) to be employed, 

- the accompanying instructions / rules / information ('header 
information') to be packaged with the digital content 12 in the package 
12 P . 

- the type of muxing that is to occur; and 
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- the name of the output file 29b to which the package 12p based on the 
digital content 12 is to be written. 

As should be understood, such dictionary 28 is easily and quickly 
modifiable by an operator of the authoring tool 1 8 (human or machine), and therefore 
the type of authoring performed by the authoring tool 18 is likewise easily and quickly 
modifiable in a dynamic manner. In one embodiment of the present invention, the 
authoring tool 1 8 includes an operator interface (not shown) displayable on a computer 
screen to a human operator. Accordingly, such operator may modify the dictionary 28 
by way of the interface, and further may be appropriately aided and/or restricted in 
modifying the dictionary 28 by way of the interface. 

In the authoring tool 18, and as seen in Fig. 2. a source filter 18a 
receives the name of the input file 29a having the digital content 12 from the dictionary 
28, and retrieves such digital content 12 from such input file and places the digital 
content 12 into a memory 29c such as a RAM or the [ike. An encoding filter 1 8b then 
performs encoding on the digital content 12 in the memory 29c to transfer the file from 
the input format to the output format according to the type of encoding specified in the 
dictionary 28 (i.e., .wav to .asp, .mp3 to .asp. etc.). and places the encoded digital 
content 12 in the memory 29c. As shown, the digital content 12 to be packaged 
(music, e.g.) is received in a compressed format such as the .wav or .mp3 fonuat, and 
is transformed into a format such as the .asp (active streaming protocol) format. Of 
course, other input and output formats may be employed without departing from the 
spirit and scope of the present invention. 

Thereafter, an encryption filter 18c encrypts the encoded digital content 
12 in the memory 29c according to the encryption / decryption key (KD) specified in 
the dictionary 28, and places the enci7pted digital content 12 in the memory 29c. A 
header filter 18d then adds the header information specified in the dictionary 28 to the 
encrypted digital content 12 in the memory 29c. 

As should be understood, depending on the situation, the package I2p 
may include multiple streams of temporally aligned digital content 12 (one stream 
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bcina shown in Fig. 2), where such multiple streams are multiplexed (i.e.. *muxed'). 
Accordingly, a mux filter 18e performs muxing on the header information and 
encrypted digital content 12 in the memory 29c according to the type of muxing 
specified in the dictionary 28, and places the result in the memory 29c. A file writer 
5 filter 18f then retrieves the result from the memory 29c and writes such result to the 
output file 29b specified in the dictionary 28 as the package 12p. 

It should be noted that in certain circumstances, the type of encoding 
to be performed will not normally change. Since the type of muxing typically is based 
on the type of encoding, it is likewise the case that the type of muxing will not 

10 normally change, either. If this is in fact the case, the dictionary 28 need not include 
parameters on the type of encoding and/or the type of muxing. Instead, it is only 
necessary that the type of encoding be 'hardwired* into the encoding filter and/or that 
the type of muxing be 'hardwired' into the mux filter. Of course, as circumstance 
require, the authoring tool 18 may not include all of the aforementioned filters, or may 

15 include other filters, and any included filter may be hardwired or may perform its 
function according to parameters specified in the dictionary 28. all without departing 
from the spirit and scope of the present invention. 

Preferably, the authoring tool 18 is implemented on an appropriate 
computer, processor, or other computing machine by way of appropriate software. The 

20 structure and operation of such machine and such software should be apparent based 
on the disclosure herein and therefore do not require any detailed discussion in the 
present disclosure, 

ARCHITECTURE - Content Server 22 

Referring again to Fig. 1, in one embodiment of the present invention, 
25 the content server 22 distributes or otherwise makes available for retrieval the packages 
I2p produced by the authoring tool 18. Such packages 12p may be distributed as 
requested by the content server 22 by way of any appropriate distribution channel 
without departing from the spirit and scope of the present invention. For example, 
such distribution channel may be the Internet or another network, an electronic bulletin 
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board. electronic mail, or the like. In addition, the content server 22 may be employed 
to copy the packages 12p onto magnetic or optical disks or other storage devices, and 
such storage devices may then be distributed. 

It will be appreciated that the content server 22 distributes packages 
12p without regard to any trust or security issues. As discussed below, such issues are 
dealt with in connection with the license server 24 and the relationship between such 
license server 24 and the user's computing device 14. In one embodiment of the 
present invention, the content server 22 freely releases and distributes packages 12p 
having digital content 12 to any distributee requesting same. However, the content 
server 22 may also release and distribute such packages 12p in a restricted manner 
without departing from the spirit and scope of the present invention. For example, the 
content server 22 may first require payment of a pre-determined distribution fee prior 
to distribution, or may require that a distributee identify itself, or may indeed make a 
determination of whether distribution is to occur based on an identification of the 
distributee. 

In addition, the content server 22 may be employed to perform 
inventory management by controlling the authoring tool 1 8 to generate a number of 
different packages 12p in advance to meet an anticipated demand. For example, the 
server could generate 100 packages I2p based on the same digital content 12. and serve 
each package 12p 10 times. As supplies of packages 12p dwindle to 20. for example, 
the content server 22 may then direct the authoring tool 1 8 to generate 80 additional 
packages 12p, again for example. 

Preferably, the content server 22 in the architecture 1 0 has a unique 
public / private key pair (PU-CS. PR-CS) that is employed as part of the process of 
evaluating a license 16 and obtaining a decryption key (KD) for decrypting 
corresponding digital content 12, as will be explained in more detail below. As is 
known, a public / private key pair is an asymmetric key. in that what is encrypted in 
one of the keys in the key pair can only be decrypted by the other of the keys in the key 
pair. In a public / private key pair encryption system, the public key may be made 
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known to the world, but the private key should always be held in confidence by the 
owner of such private key. Accordingly, if the content server 22 encrypts data with its 
private key (PR-CS), it can send the encrypted data out into the world with its public 
key (PU-CS) for decryption purposes. Correspondingly, if an external device wants 
5 to send data to the content server 22 so that only such content server 22 can decrypt 
such data, such external device must first obtain the public key of the content server 
22 (PU-CS) and then must encrypt the data with such public key. Accordingly, the 
content server 22 (and only the content server 22) can dien employ its private key (PR- 
CS) to decrypt such encrypted data. 

1 0 As with the authoring tool 1 8. the content server 22 is implemented on 

an appropriate computer, processor, or other computing machine by way of appropriate 
software. The structure and operation of such machine and such software should be 
apparent based on the disclosure herein and therefore do not require , any detailed 
discussion in the present disclosure. Moreover, in one embodiment of the present 

15 invention, the authoring tool 18 and the content server 22 may reside on a single 
computer, processor, or other computing machine, each in a separate work space. It 
should be recognized, moreover, that the content server 22 may in certain 
circumstances include the authoring tool 1 8 and/or perform the functions of the 
authoring tool 18, as discussed above. 

20 Structure of Digital Content Package 12p 

Referring now to Fig. 3. in one embodiment of the present invention, 
the digital content package 12p as distributed by the content server 22 includes: 

- the digital content 12 encrypted with the encryption / decryption key 
(KD), as was discussed above (i.e.. (KD(CONTENT))): 

25 - the content ID (or package ID) of such digital content 12 (or package 

12p); 

- the key ID of the decryption key (KD); 

- license acquisition information, preferably in an un-encrypted form; 
and 
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- the key KD encrypting the content server 22 public key (PU-CS), 
signed by the content server 22 private key (PR-CS) (i.e., (KD (PU-CS) 
S (PR-CS))). 

With regard to (KD (PU-CS) S (PR-CS)). it is to be understood that 
5 such item is to be used in connection with validating the digital content 1 2 and/or 
package 12 P , as will be explained below. Unlike a certificate with a digital suture 
(see below), the key (PU-CS) is not necessary to get at (KD (PU-CS)). Instead, the 
key (PU-CS) is obtained merely by applying the decryption key (KD). Once so 
obtained, such key (PU-CS) may be employed to test the validitv of the signature (S 
0 (PR-CS)). 

It should also be understood that for such package 12p to be 
constructed by the authoring tool 1 8, such authoring tooll 8 must already possess the 
license acquisition information and (KD (PU-CS) S (PR-CS)). presumably as header 
information supplied by the dictionary 28. Moreover, the authoring tool 18 and the 
) content server 22 must presumably interact to construct (KD (PU-CS) S (PR-CS)). 
Such interaction may for example include the steps of: 

- the content server 22 sending (PU-CS) to the authoring tool 18; 

- the authoring tool 1 8 encrypting (PU-CS) with (KD) to produce (KD 
(PU-CS)); 

- the authoring tool 1 8 sending (KD (PU-CS)) to the content server 22; 

- the content server 22 signing (KD (PU-CS)) with (PR-CS) to produce' 
(KD (PU-CS) S (PR-CS)); and 

- the content server 22 sending (KD (PU-CS) S (PR-CS)) to the 
authoring tool 18. 

ARCHITECT URE - License Servpr 74 

Referring again to Fig. 1, in one embodiment of the present invention, 
the license server 24 performs the functions of receiving a request for a license 1 6 from 
a user's computing device 14 in connection with a piece of digital content 12, 
determining whether the user's computing device 1 4 can be trusted to honor an issued 
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license 1 6. negotiating such a license 1.6. constructing such license 1 6. and transmitting 
such license 16 to the user's computing device 1 4. Preferably, such transmitted license 
16 includes the decryption key (KD) for decrypting the digital content 12. Such 
license server 24 and such functions will be explained in more detail below. 
Preferably, and like the content server 22. the license server 24 in the architecture 10 
has a unique public / private key pair (PU-LS. PR-LS) that is employed as part of the 
process of evaluating a license 1 6 and obtaining a decryption key (KD) for decrypting 
corresponding digital content 12, as will be explained in more detail below. 

As with the authoring tool 18 and the content server 22, the license 
server 24 is implemented on an appropriate computer, processor, or other computing 
machine by way of appropriate software. The structure and operation of such machine 
and such software should be apparent based on the disclosure herein and therefore do 
not require any detailed discussion in the present disclosure. Moreover, in one 
embodiment of the present invention the authoring tool 1 8 and/or the content server 
22 may reside on a single computer, processor, or other computing machine together 
with the license server 24, each in a separate work space. 

In one embodiment of the present invention, prior to issuance of a 
license 16, the license server 24 and the content server 22 enter into an agency 
agreement or the like, wherein the license server 24 in effect agrees to be the licensing 
authority for at least a portion of the digital content 1 2 distributed by the content server 
22. As should be understood, one content server 22 may enter into an agency 
agreement or the like with several license servers 24. and/or one license server 24 may 
enter into an agency agreement or the like with several content servers 22. all without 
departing from the spirit and scope of the present invention. 

Preferably, the license server 24 can show to the world that it does in 
fact have the authority to issue a license 1 6 for digital content 1 2 distributed by the 
content server 22. To do so, it is preferable that the license server 24 send to the 
content server 22 the license server 24 public key (PU-LS). and that the content server 
22 then send to the license server 24 a digital certificate containing PU-LS as die 
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contents signed by the content server 22 private key (CERT (PU-LS) S (PR-CS)). As 
should be understood, the contents (PU-LS) in such certificate can only be accessed 
with the content server 22 public key (PU-CS). As should also be understood, in 
general, a digital signature of underlying data is an encrypted form of such data, and 
will not match such data when decrypted if such data has been adulterated or otherwise 
modified. 

As a licensing authority in connection with a piece of digital content 
12, and as part of the licensing function, the license server 24 must have access to the 
decryption key (KD) for such digital content 12. Accordingly, it is preferable that 
license server 24 have access to the content-key database 20 that has the decryption key 
(KD), key ID, and content ID (or package ID) for such digital content 12 (or package 
12p). 

ARCHITECTURE - Black Box Server 26 

Still referring to Fig. 1, in one embodiment of the present invention, the 
black box server 26 performs the functions of installing and/or upgrading a new black 
box 30 in a user's computing device 14. As will be explained in more detail below, 
the black box 30 performs encryption and decryption functions for the users 
computing device 14. As will also be explained in more detail below, the black box 
30 is intended to be secure and protected from attack. Such security and protection is 
provided, at least in part, by upgrading the black box 30 to a new version as necessary 
by way of the black box server 26. as will be explained in more detail below. 

As with the authoring tool 1 8. the content server 22. and the license 
server 24. the black box server 26 is implemented on an appropriate computer, 
processor, or other computing machine by way of appropriate software. The structure 
and operation of such machine and such software should be apparent based on the 
disclosure herein and therefore do not require any detailed discussion in the present 
disclosure. Moreover, in one embodiment of the present invention the license server 
24. the authoring tool 18, and/or the content server 22 may reside on a single computer, 
processor, or other computing machine together with the black box server 26. each in 
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a separate work space. Note, though, that for security purposes, it may be wise to have 
the black box server 26 on a separate machine. 
ARCHITECTURE - User's Computing Device 14 

Referring now to Fig. 4. in one embodiment of the present invention, 
the user's computing device 14 is a persona! computer or the like, having elements 
including a keyboard, a mouse, a screen, a processor. RAM. ROM. a hard drive, a 
floppy drive, a CD player, and/or the like. However, the user s computing device 14 
may also be a dedicated viewing device such as a television or monitor, a dedicated 
audio device such as a stereo or other music player, a dedicated printer, or the like, 
among other things, all without departing from the spirit and scope of the present 
invention. 

The content owner for a piece of digital content 12 must trust that the 
user's computing device 14 will abide by the rules specified by such content owner, 
i.e. that the digital content 12 will not be rendered unless the user obtains a license 16 
that permits the rendering in the manner sought. Preferably, then, the user's computing 
device 14 must provide a trusted component or mechanism 32 that can satisfy to the 
content owner that such computing device 14 will not render the digital content 12 
except according to the license rules embodied in the license 1 6 associated with the 
digital content 12 and obtained by the user. 

Here, the trusted mechanism 32 is a Digital Rights Management 
(DRM) system 32 that is enabled when a user requests that a piece of digital content 
12 be rendered, that determines whether the user has a license 1 6 to render the digital 
content 12 in the manner sought, that effectuates obtaining such a license 16 if 
necessary, that determines whether the user has the right to play the digital content 12 
according to the license 16, and that decrypts the digital content 12 for rendering 
purposes if in fact the user has such right according to such license 1 6. The contents 
and function of the DRM system 32 on the usefs computing device 14 and in 
connection with the architecture 10 are described below. 
DRM SYSTEM 32 
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The DRM system 32 performs four main functions with the 
architecture 10 disclosed herein: (1) content acquisition. (2) license acquisition, (3) 
content rendering, and (4) black box 30 installation / update. Preferably, any of the 
functions can be performed at any time, although it is recognized that some of the 
functions already require that digital content 12 be acquired. 
DRM SYSTEM 32 - Content Acquisition 

Acquisition of digital content 12 by a user and/or the user's computing 
device 14 is typically a relatively straight-forward matter and generally involves 
placing a file having encrypted digital content 12 on the user's computing device 14. 
Of course, to work with the architecture 1 0 and the DRM system 32 disclosed herein, 
it is necessary that the encrypted digital content 1 2 be in a form that is amenable to 
such architecture 10 and DRM system 32, such as the digital package 12p as will be 
described below. 

As should be understood, the digital content 12 may be obtained in any 
manner from a content server 22, either directly or indirectly, without departing from 
the spirit and scope of the present invention. For example, such digital content 1 2 may 
be downloaded from a network such as the Internet. located on an obtained optical or 
magnetic disk or the like, received as part of an E-mail message or the like, or 
downloaded from an electronic bulletin board or the like. 

Such digital content 12, once obtained, is preferably stored in a manner 
such that the obtained digital content 12 is accessible by a rendering application 34 (to 
be described below) running on the computing device 14. and by the DRM system 32. 
For example, the digital content 12 may be placed as a file on a hard drive (not shown) 
of the user's computing device 14, or on a network server (not shown) accessible to the 
computing device 14. In the case where the digital content 12 is obtained on an optical 
or magnetic disk or the like, it may only be necessary that such disk be present in an 
appropriate drive (not shown) coupled to the user s computing device 14. 

In the present invention, it is not envisioned that any special tools are 
necessary to acquire digital content 12. either from the content server 22 as a direct 
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distribution source or from some intermediary as an indirect distribution source. That 
is. it is preferable that digital content 12 be as easily acquired as any other data file. 
However, the DRM system 32 and/or the rendering application 34 may include an 
interface (not shown) designed to assist the user in obtaining digital content 12 . For 
example, the interface may include a web browser especially designed to search for 
digital content 12, links to pre-defined Internet web sites that are known to be sources 
of digital content 12, and the like. 
DRM SYSTEM 32 - Content Rendering. Part 1 

Referring now to Fig. 5A, in one embodiment of the present invention, 
assuming the encrypted digital content 12 has been distributed to and received by a 
user and placed by the user on the computing device 14 in the form of a stored file, the 
user will attempt to render the digital content 12 by executing some variation on a 
render command (step 501). For example, such render command may be embodied as 
a request to 'play' or 'open' the digital content 12. In some computing environments, 
such as for example the "MICROSOFT WINDOWS" operating system, distributed by 
MICROSOFT Corporation of Redmond, Washington, such play or open command 
may be as simple as 'clicking' on an icon representative of the digital content 12. Of 
course, other embodiments of such render command may be employed without 
departing from the spirit and scope of the present invention. In general, such render 
command may be considered to be executed whenever a user directs that a file having 
digital content 1 2 be opened, run, executed, and/or the 1 ike. 

Importantly, and in addition, such render command may be embodied 
as a request to copy the digital content 12 to another form, such as to a printed form, 
a visual form, an audio form, etc. As should be understood, the same digital content 
12 may be rendered in one form, such as on a computer screen, and then in another 
form, such as a printed document. In the present invention, each type of rendering is 
performed only if the user has the right to do so. as will be explained below. 

In one embodiment of the present invention, the digital content 12 is in 
the form of a digital file having a file name ending with an extension, and the 



